Hundreds of Salesforce Customers Hit by Widespread Data Theft Campaign

Hundreds of Salesforce customers were hit by a widespread data theft campaign, according to GTIG. The attacks did not exploit a vulnerability in the core Salesforce platform but relied on compromised OAuth tokens for Salesloft Drift, a third-party AI chat bot. The campaign, UNC6395, operated between 8 August and 18 August 2025, with GTIG noting the actor systematically exported large volumes of data and sought secrets such as AWS access keys and Snowflake-related tokens.

Roughly 700 Salesforce customers were reportedly compromised, though Salesforce says only a small number of customer instances were accessed via the Drift connection and all affected customers were notified. Drift tokens were revoked on 20 August, and organisations need to re-authenticate Drift-Salesforce connections to re-enable the integration, while Salesloft stated there is no evidence of ongoing malicious activity.